It wasn't when I did the

maissiat · ‎03-15-2016

Dear All,

I would like to enable FNF on a 4500X-16 switches in VSS mode. I followed the guide from Cisco , but nothing is send to my collector (Prime 3.0)

Context :

Cisco 4500X-16 in VSS, IP Base license, IOS-XE 03.07.02.E , remote site

Collector : Headquarter

WAN = VPN Tunnel 100Mb - Allow ANY

My config on the 4500X

flow record r1
match datalink dot1q priority
match ipv4 tos
match ipv4 ttl
match ipv4 protocol
match ipv4 source address
match ipv4 destination address
match transport source-port
match transport destination-port
collect interface input
collect counter bytes
collect counter packets
collect timestamp sys-uptime first
collect timestamp sys-uptime last
!
!
flow exporter e1
destination "IP Collector"
source Vlan96
transport udp 9991
!
!
flow monitor m1
exporter e1
cache timeout inactive 30
cache timeout active 60
cache entries 1000
record r1

Interface tengi1/1/4

ip flow monitor m1 input

It looks that no flows are collected

if I ran the sh flow monitor m1 statistics cmd, I see nothing , all fields are at zero.

. Any idea is warmly welcome, because I have a similar setup also on a remote site but on 3750X and works fine.

Thanks

Maissiat

Mark Malone · ‎03-15-2016

hey your missing match interface input/output and output features , can you try this it works for me no issues see flows , I use pi 3.0 and CA collector

flow record FLOW-RECORD
description record to monitor network traffic
match ipv4 tos
match ipv4 protocol
match ipv4 source address
match ipv4 destination address
match transport source-port
match transport destination-port
match interface input
match interface output
collect routing source as
collect routing destination as
collect routing next-hop address ipv4
collect transport tcp flags
collect counter bytes
collect counter packets
collect timestamp sys-uptime first
collect timestamp sys-uptime last
!
!
flow exporter NetQos
description export Netflow traffic to HQ
destination 172.x.x.x
source Loopbackxxx
output-features
transport udp 9995
template data timeout 300
option interface-table timeout 1000
option exporter-stats timeout 1000
!
!
flow monitor xxxxxx
description Used for ipv4 traffic analysis (Mapped To FLOW-RECORD)
exporter NetQos
statistics packet protocol
record FLOW-RECORD

maissiat · ‎03-16-2016

Dear Mark,

Thank you for your exemple , I tried it , but still have no flows. I have a second 4500X on another remote site , I will try with this one. The IOS version is not the same 3.6, maybe there is an issue with the 3.7 version (didn't see any caveats on Netflow topic in the relase note).

Do you have also a 4500X , if yes which IOS version is installed ?

Maissiat

Mark Malone · ‎03-16-2016

hey no i dont have 4500x but i do have flexible netflow running on multiple devices with this script above had it checked by TAC as well as i had an issue on certain routers and found out if output-features is not enabled it wont push the flow even though it did on certain switches without it

did you check the flow eporter what does it show ?

#sh flow exporter statistics
Flow Exporter NetQos:
Packet send statistics (last cleared 1y6w ago):
    Successfully sent:         105357266             (137671530259 bytes)

Client send statistics:
    Client: Flow Monitor xxxxxxx
      Records added:           2788777352
        - sent:                2788777318
      Bytes added:             131072535544
        - sent:                131072533946

    Client: Option options interface-table
      Records added:           6538947
        - sent:                6538947
      Bytes added:             653894700
        - sent:                653894700

    Client: Option options exporter-statistics
      Records added:           20252
        - sent:                20252
      Bytes added:             567056
        - sent:                567056

maissiat · ‎03-16-2016

Hi ,

sh exporter statistics is empty, all at 0

Flow Exporter e1:
Packet send statistics (last cleared 1w4d ago):
Successfully sent: 0 (0 bytes)

Client send statistics:
    Client: Flow Monitor m1
      Records added:           0
      Bytes added:             0

For me it like FNF is not active.. but why ...

Mark Malone · ‎03-16-2016

there is known bugs on 4500x netflow take a look at this , could be the image

https://blogs.manageengine.com/network/netflowanalyzer/2011/01/25/missing-out-traffic-with-cisco-4500.html

Andreas Schneider · ‎08-09-2017

Hello,

I have this issue too. I ran 03.08.00.E but the exporter does not send any data.

The statistics are always 0. I tried several configs but whatever I configured it does not send any data.

Here is my current config:

flow record FNF-input
 description IPv4 NetFlow
 match datalink mac source address input
 match datalink mac destination address input
 match ipv4 tos
 match ipv4 protocol
 match ipv4 source address
 match ipv4 destination address
 match transport source-port
 match transport destination-port
 match interface input
 collect interface output
 collect counter bytes long
 collect counter packets long
!
!
flow record FNF-output
 description IPv4 NetFlow
 match ipv4 tos
 match ipv4 protocol
 match ipv4 source address
 match ipv4 destination address
 match transport source-port
 match transport destination-port
 match interface output
 collect interface input
 collect counter bytes long
 collect counter packets long
!
!
flow exporter export-to-PRTG
 description export the flow to PRTG
 destination 172.16.130.30
 source Loopback0
 transport udp 2058
!
!
flow monitor NetFlow_input
 description IPv4 FNF ingress exports
 exporter export-to-PRTG
 cache timeout active 60
 record FNF-input
!
!
flow monitor NetFlow_output
 description IPv4 FNF egress exports
 exporter export-to-PRTG
 cache timeout active 60
 record FNF-output

I applied it to interface Te1/1/4 with:

ip flow monitor NetFlow_input Input

The statistics are always empty:

sh flow exporter statistics:

Flow Exporter export-to-PRTG:
  Packet send statistics (last cleared 01:14:47 ago):
    Successfully sent:         0                     (0 bytes)

  Client send statistics:
    Client: Flow Monitor NetFlow_input
      Records added:           0
      Bytes added:             0

    Client: Flow Monitor NetFlow_output
      Records added:           0
      Bytes added:             0

What am I missing?

Kind regards,

Andreas

Mark Malone · ‎08-09-2017

did you try UDP 2055 rather than 2058

3.6.6 is still the recommended ios might be worth trying that rule out the software , if its not that you can always move back up to 3.8 or try another MD release 3.8.0 is an ED

Sebastian Pusta · ‎08-09-2017

Hi Andreas,

I was able solve this by upgrading to 03.08.03.E.

BR,

Sebastian

Andreas Schneider · ‎08-09-2017

Hi Sebastian,

hmm, 03.08.03E is a deferred release.

Kind regards,

Andreas

Sebastian Pusta · ‎08-09-2017

It wasn't when I did the upgrade five months ago :)

In this case, you should try 03.08.04E.

BR,

Sebastian

Mark Malone · ‎08-09-2017

Just pick another Main Deployment release its most likely the software

Image's can get deferred instantly if something heavily critical is found Cisco can just remove them from download without warning set them as deferred

Andreas Schneider · ‎08-09-2017

Hi Mark,

I was on 3.6 but no luck. I tested it on 03.08.00.E and 03.08.01.E both no luck.

I also changed the udp port... and send the data to my PC with wireshark looking for udp traffic - nothing. So, the counters from the statistics on the Switch are true.

If counters = 0 then no flow data is send... :(

Kind regards,

Andreas

maissiat · ‎03-16-2016

Hi,

Thanks but always same issue.. Wird.

I will change the switch :-)

No Still looking to resolve the issue.

Maissiat

Shaunak · ‎03-16-2016

Hi Maissiat,

What is the SUP on the switch? Here is an excerpt from a white paper--

"Flexible NetFlow is only supported on Supervisor Engine 7-E, Supervisor Engine 7L-E, and Catalyst 4500X."

Here's the link to the white paper, check if the prerequisites are fulfilled or if you're environment is hitting a limitation--

http://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst4500/15-1/XE_330SG/configuration/guide/config/fnf.pdf

Thanks,

Shaunak

Flexible Netflow not working on 4500X-16